Privacy Policy

1. Who we are

Repostly Inc. is the data controller for personal information processed through the Service. Repostly is a business tool, not a consumer product: accounts are issued only to people acting on behalf of an approved organisation. You can reach us by email at workforkhauf@gmail.com or by post at:

2. The short version

We collect the minimum we need to run the Service: who you are, which Facebook Pages you have authorised us to publish to, which videos you asked us to publish, and a record of what we published on your behalf.

We do not sell your data. We do not use it for advertising. We do not build profiles of you or of anyone whose content you publish, and we do not use your content or your Facebook data to train machine-learning models.

The most sensitive thing we hold is your Facebook access tokens, because those let us post to your Pages. They are encrypted at rest, never displayed back to you, and never sent to your browser.

3. Information we collect

We collect three broad categories of information.

a. Information you give us directly

• Account information. Your name, email address, and a password. We never store the password itself — only a bcrypt hash, which cannot be reversed. Nobody at our company can see or recover it.
• Approval records. Because access is granted rather than self-serve, a new account stays inactive until an administrator approves it. We record who approved or rejected each account, when, and any note the reviewer left.
• Content instructions. The source video URLs you submit, the destination Page you choose, captions you write, and any schedule you set.
• Support requests. If you email us or use a form on the site, we receive whatever you send, so we can reply.

b. Information we collect automatically

• Session cookie. Set with the HttpOnly, Secure and SameSite attributes, so it cannot be read by JavaScript in your browser and is not sent with cross-site requests. It holds a signed session reference and an expiry — never your password or your Facebook tokens.
• Log and device data. Standard server logs including IP address, request path, response code and timing, used for security and debugging.
• Rate-limiting data. We record IP addresses transiently to limit sign-in and contact-form attempts, which is how we stop other people brute-forcing your account.

c. What we do not collect

We do not use advertising cookies, third-party tracking pixels, or cross-site analytics. We do not collect content behind a login wall, paywall, or any other technical access control, and we do not bypass such controls.

4. Information we receive from Facebook

If you choose to connect a Facebook account, we use Facebook Login and receive only what the permissions you grant allow. We request the following permissions, for the following purposes, and nothing else:

• public_profile — your Facebook user ID and name, so we can show which account is connected and distinguish it from others.
• pages_show_list — the list of Pages you manage, so you can choose which Page a video publishes to.
• pages_read_engagement — Page metadata such as name and category, so the Page picker shows something recognisable rather than a numeric ID.
• pages_manage_posts — the ability to publish video, Reels and photo posts to the Pages you selected. This is the core function of the product, and nothing publishes without an explicit action by you.
• pages_manage_engagement — management of the posts we created on your behalf, for example to remove a post you asked us to remove.
• business_management — where your Pages are owned by a Business Manager account, to confirm you are authorised to act for those Pages.

a. Access tokens and how we protect them

To publish on your behalf we must store the access tokens Facebook issues. We exchange the short-lived token for a long-lived one and derive a Page access token for each Page you connect. Those tokens are the keys to your Pages and we treat them that way.

Every token is encrypted before it is written to our database, using AES-256-GCM with a key held separately from the database. GCM is an authenticated cipher, so a tampered value fails to decrypt rather than silently returning something wrong. Tokens are never rendered in the interface, never included in a response to your browser, and never written to application logs.

You can revoke our access at any time, from inside the product or from Facebook's own Business Integrations settings. Revocation is immediate on Facebook's side; our stored copy becomes useless at that moment and is deleted on our next token health check, or sooner if you ask.

5. Information about the content you publish

When you submit a source video URL we store that URL, the identifier and handle of the originating creator account, and technical metadata about the file such as duration, resolution, codec and file size. We store the resulting Facebook post identifier once publishing succeeds, and any error message if it fails.

The video file itself is temporary. It is downloaded to encrypted storage, prepared for upload, transmitted to Facebook, and then deleted. We do not operate a content library and we do not keep copies of the videos you publish once the job has completed.

We do keep a durable record of each publishing action: which source account it came from, which Page it went to, who requested it, and when. This audit trail exists so you can answer a rights query about anything published through the Service, and is deliberately retained after the media is deleted.

6. Rights in the content you publish

You are responsible for holding the rights to every piece of content you publish through the Service, and for complying with the terms of the platform the content came from. We provide a place to record the licence covering each source account, because being able to produce that evidence quickly is what resolves a rights dispute.

Please be aware that Meta's Rights Manager identifies content by matching audio and video fingerprints. It has no visibility of private agreements between you and a creator, so a claim can be raised against material you are properly licensed to use. The records you keep here are what let you respond.

7. How we use information

We use the information described above to:

• Provide, operate and maintain the Service.
• Authenticate you, secure your account, and prevent fraud and abuse.
• Publish the content you instruct us to publish, to the Pages you selected.
• Maintain the audit trail that lets you answer rights and compliance questions.
• Send transactional email such as account notifications and security alerts. You cannot opt out of these while you hold an active account.
• Respond to support requests and feedback.
• Debug problems, measure reliability, and improve the product.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not share it with third parties for their own advertising.

8. Who we share information with

We share personal information only with the categories of recipient below, and only as needed for the purposes described in this policy.

a. Meta

We transmit the video, the caption and the publishing instruction to Facebook's APIs, because that is the service you asked us to perform. Meta's own terms then govern that data.

b. Service providers

We use a small set of vendors to run the Service — cloud hosting, managed database, object storage and email delivery. Each is bound by contractual terms, including data processing agreements where applicable, that require them to protect your data and use it only to provide their service to us. For an up-to-date list, email us.

c. Legal and safety

We may disclose information where we have a good-faith belief it is necessary to comply with a law or enforceable governmental request, to enforce our Terms, to prevent fraud or abuse, or to protect the rights, property or safety of our users or the public. Where we are permitted to tell you about such a request, we will.

d. Business transfers

If the business is involved in a merger, acquisition or sale of assets, your information may transfer as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

9. How long we keep information

We keep personal information for as long as your account is active and for a limited period afterwards, so we can comply with legal obligations, resolve disputes and enforce our agreements. Specifically:

• Downloaded media. Deleted as soon as the publishing job finishes, typically within minutes.
• Account and content records. Kept while your account exists. On deletion we remove or anonymise them within 30 days, except where retention is legally required.
• Access tokens. Kept until you disconnect the Facebook account or delete your account, then removed.
• Publishing history and audit records. Kept while your account is open and for a period afterwards, because they are the evidence you would need to answer a rights claim about something published historically.
• Server logs. Retained on a rolling short-term basis for security and debugging, then deleted.

10. How we protect information

Passwords are hashed with bcrypt. Facebook tokens are encrypted with AES-256-GCM. Traffic is encrypted in transit with TLS. Sessions are held in HttpOnly cookies and validated against the database on every request, so suspending an account takes effect immediately rather than whenever a token happens to expire. Access to production systems is limited to the people who need it.

No system is perfectly secure, and we would rather say so than imply otherwise. If you believe your account has been compromised or you have found a security issue, email workforkhauf@gmail.com and we will respond as quickly as we can. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulator as required by law.

11. Your rights and choices

Depending on where you live, you have the right to access, correct, delete, export, or restrict the processing of your personal information, and to object to certain processing. You also have the right to complain to your local data protection authority.

• Access and correction. Update your profile and email from your account settings.
• Export. Request a copy of your account data by emailing workforkhauf@gmail.com.
• Deletion. Follow the step-by-step instructions on our Data Deletion page, linked in the footer of this site.
• Disconnect Facebook. Remove our access without deleting your account, from your settings or from Facebook's Business Integrations page.

For any other request, email workforkhauf@gmail.com. We will verify that the request genuinely comes from you before responding, and answer within the timeframes required by law — typically 30 days. We do not charge for this and we will not treat you differently for asking.

For users in the European Economic Area, UK and Switzerland

Our legal bases for processing are: performance of our contract with you, our legitimate interests in operating and securing the Service, your consent where required, and compliance with legal obligations.

For California residents

You have rights under the California Consumer Privacy Act as amended by the CPRA, including the right to know what personal information we collect, to delete it, to correct it, and to opt out of any “sale” or “sharing” of personal information as those terms are defined under California law. We do not sell or share your personal information.

12. International data transfers

Our infrastructure and our providers may process data in countries other than your own, including the United States. Where personal data leaves the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

13. Children

The Service is a business product, is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with information, email workforkhauf@gmail.com and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make a material change we will update the “Effective” date at the top and, where appropriate, notify account holders directly rather than quietly editing the page. Continued use of the Service after a change takes effect means you accept the updated policy.

15. How to contact us

For any privacy question or request, email workforkhauf@gmail.com. For general support, email workforkhauf@gmail.com. Deletion has its own page with step-by-step instructions: Data Deletion Instructions.

This policy is governed by the laws of Pakistan.